Guillaume BOURGEOIS
1046 lines
50 KiB
YAML
1046 lines
50 KiB
YAML
id: crowdstrike
|
|
name: CrowdStrike Falcon
|
|
version: 1.2.0
|
|
description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
|
|
changelog: "1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. Scripts obtain an OAuth2 bearer token from
|
|
# {base_url}/oauth2/token using client_id/client_secret, then call the API.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "CrowdStrike API base URL (region-specific), e.g. https://api.crowdstrike.com or https://api.eu-1.crowdstrike.com"
|
|
default: https://api.crowdstrike.com
|
|
client_id:
|
|
type: string
|
|
description: "Falcon API client ID (Support → API Clients and Keys)"
|
|
x-soar-sensitive: true
|
|
client_secret:
|
|
type: string
|
|
description: "Falcon API client secret"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- client_id
|
|
- client_secret
|
|
|
|
# Documented for reference; the bundled scripts perform the OAuth2 client-
|
|
# credentials exchange themselves and send Authorization: Bearer <token>.
|
|
auth:
|
|
- id: oauth2
|
|
type: oauth2_client_credentials
|
|
secret_field: client_secret
|
|
|
|
commands:
|
|
# ── Enrichment / read ─────────────────────────────────────────────────────
|
|
- id: search_device
|
|
name: crowdstrike-search-device
|
|
description: "Search managed devices (hosts) by hostname, IP, platform, or status; returns full device details for matches."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Hostname to match (exact)." }
|
|
ip: { type: string, description: "Local IP address to match." }
|
|
platform_name: { type: string, description: "Platform: Windows, Mac, or Linux." }
|
|
status: { type: string, description: "Containment status: normal, containment_pending, contained, or lift_containment_pending." }
|
|
limit: { type: number, description: "Max device IDs to resolve (default 50)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_device_details
|
|
name: crowdstrike-get-device-details
|
|
description: "Retrieve full details for one or more devices by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated device IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: device_online_state
|
|
name: crowdstrike-device-online-state
|
|
description: "Get the current online/offline state for one or more devices by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated device IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_detections
|
|
name: crowdstrike-search-detections
|
|
description: "Search detections/alerts using an FQL filter; returns full alert entities for matches."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "FQL filter (default \"product:'epp'+type:'ldt'\")." }
|
|
limit: { type: number, description: "Max alerts to return (default 50)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_host_groups
|
|
name: crowdstrike-list-host-groups
|
|
description: "List host groups, optionally filtered by an FQL expression."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "Optional FQL filter, e.g. \"name:*'*prod*'\"." }
|
|
limit: { type: number, description: "Max groups to return (default 50)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: spotlight_search_vulnerability
|
|
name: crowdstrike-spotlight-search-vulnerability
|
|
description: "Search Falcon Spotlight vulnerabilities by FQL filter or CVE ID, with CVE facet detail."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "FQL filter (defaults to \"status:'open'\")." }
|
|
cve_id: { type: string, description: "Comma-separated CVE IDs; overrides filter when provided." }
|
|
limit: { type: number, description: "Max vulnerabilities to return (default 50)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ioc_device_count
|
|
name: crowdstrike-ioc-device-count
|
|
description: "Count how many devices have observed a given indicator (IOC)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
|
|
value: { type: string, description: "Indicator value." }
|
|
required: [type, value]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Actions (containment, detection workflow, IOC management) ──────────────
|
|
- id: contain_host
|
|
name: crowdstrike-contain-host
|
|
description: "Network-contain one or more hosts (isolate them while keeping Falcon connectivity)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated device IDs to contain." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: lift_containment
|
|
name: crowdstrike-lift-containment
|
|
description: "Lift network containment on one or more hosts (reconnect them)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated device IDs to release." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: resolve_detection
|
|
name: crowdstrike-resolve-detection
|
|
description: "Update detections/alerts: change status, append a comment, and/or assign to an analyst."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated alert composite IDs." }
|
|
status: { type: string, description: "New status: new, in_progress, closed, or reopened." }
|
|
comment: { type: string, description: "Optional comment to append." }
|
|
assign_to_uuid: { type: string, description: "Optional analyst UUID to assign the detection to." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: upload_custom_ioc
|
|
name: crowdstrike-upload-custom-ioc
|
|
description: "Create a custom IOC indicator (allow/prevent/detect) applied globally."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Indicator type: sha256, md5, domain, ipv4, or ipv6." }
|
|
value: { type: string, description: "Indicator value." }
|
|
action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." }
|
|
platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." }
|
|
severity: { type: string, description: "Optional severity: informational, low, medium, high, or critical." }
|
|
description: { type: string, description: "Optional description." }
|
|
source: { type: string, description: "Optional source label." }
|
|
required: [type, value, action, platforms]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_custom_ioc
|
|
name: crowdstrike-delete-custom-ioc
|
|
description: "Delete one or more custom IOC indicators by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated IOC indicator IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Real Time Response ────────────────────────────────────────────────────
|
|
- id: rtr_run_command
|
|
name: crowdstrike-rtr-run-command
|
|
description: "Open an RTR batch session and run a read-only command (e.g. ls, ps, cat) on the target hosts."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_ids: { type: string, description: "Comma-separated device IDs." }
|
|
command_type: { type: string, description: "Base command, e.g. ls, ps, cat, reg." }
|
|
full_command: { type: string, description: "Full command string, e.g. 'ls C:\\\\'." }
|
|
queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
|
|
timeout: { type: number, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_ids, command_type, full_command]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_run_script
|
|
name: crowdstrike-rtr-run-script
|
|
description: "Open an RTR batch session and run a script via runscript (cloud-stored by name or inline raw PowerShell)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_ids: { type: string, description: "Comma-separated device IDs." }
|
|
script_name: { type: string, description: "Name of a cloud-stored RTR script (exactly one of script_name/raw)." }
|
|
raw: { type: string, description: "Inline raw PowerShell script (exactly one of script_name/raw)." }
|
|
queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
|
|
timeout: { type: number, description: "Script timeout in seconds (default 30)." }
|
|
required: [host_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_list_processes
|
|
name: crowdstrike-rtr-list-processes
|
|
description: "Open an RTR session on a single host and list running processes (ps)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "A single device ID." }
|
|
queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
|
|
timeout: { type: number, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_kill_process
|
|
name: crowdstrike-rtr-kill-process
|
|
description: "Open an RTR session on a single host and kill one or more processes by PID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "A single device ID." }
|
|
process_ids: { type: string, description: "Comma-separated process IDs (PIDs) to kill." }
|
|
queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
|
|
timeout: { type: number, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_id, process_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_custom_iocs
|
|
name: crowdstrike-search-custom-iocs
|
|
description: "Search custom IOC indicators using optional FQL filter parts (type, value, source, expiration)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
types: { type: string, description: "Indicator type filter value, e.g. domain or sha256." }
|
|
values: { type: string, description: "Indicator value filter." }
|
|
sources: { type: string, description: "Source label filter." }
|
|
expiration: { type: string, description: "Expiration date filter (ISO 8601)." }
|
|
limit: { type: string, description: "Max results to return (default 50)." }
|
|
sort: { type: string, description: "Sort expression, e.g. created_on.desc." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_custom_ioc
|
|
name: crowdstrike-get-custom-ioc
|
|
description: "Retrieve a custom IOC indicator by its ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ioc_id: { type: string, description: "IOC indicator ID to retrieve." }
|
|
required: [ioc_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: update_custom_ioc
|
|
name: crowdstrike-update-custom-ioc
|
|
description: "Update an existing custom IOC indicator (action, platforms, severity, source, description, expiration)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ioc_id: { type: string, description: "IOC indicator ID to update." }
|
|
action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." }
|
|
platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." }
|
|
severity: { type: string, description: "Severity: informational, low, medium, high, or critical." }
|
|
source: { type: string, description: "Source label." }
|
|
description: { type: string, description: "Description text." }
|
|
expiration: { type: string, description: "Expiration date (ISO 8601)." }
|
|
required: [ioc_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: batch_upload_custom_ioc
|
|
name: crowdstrike-batch-upload-custom-ioc
|
|
description: "Create multiple custom IOC indicators in a single call by providing a JSON array of indicator objects."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
multiple_indicators_json: { type: string, description: "JSON array string of indicator objects to create." }
|
|
required: [multiple_indicators_json]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: processes_ran_on
|
|
name: crowdstrike-processes-ran-on
|
|
description: "List process IDs that ran a given indicator on a specific device."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
|
|
value: { type: string, description: "Indicator value." }
|
|
device_id: { type: string, description: "Device ID to scope the query." }
|
|
required: [type, value, device_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: process_details
|
|
name: crowdstrike-process-details
|
|
description: "Retrieve full details for one or more processes by process ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated process IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: device_ran_on
|
|
name: crowdstrike-device-ran-on
|
|
description: "List device IDs on which a given indicator has been observed."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
|
|
value: { type: string, description: "Indicator value." }
|
|
required: [type, value]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: create_host_group
|
|
name: crowdstrike-create-host-group
|
|
description: "Create a new host group (static or dynamic) with an optional description and assignment rule."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
name: { type: string, description: "Name for the new host group." }
|
|
group_type: { type: string, description: "Group type: static or dynamic." }
|
|
description: { type: string, description: "Optional description for the host group." }
|
|
assignment_rule: { type: string, description: "Optional FQL assignment rule (required for dynamic groups)." }
|
|
required: [name, group_type]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: update_host_group
|
|
name: crowdstrike-update-host-group
|
|
description: "Update an existing host group's name, description, or assignment rule."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "ID of the host group to update." }
|
|
name: { type: string, description: "New name for the host group." }
|
|
description: { type: string, description: "New description for the host group." }
|
|
assignment_rule: { type: string, description: "New FQL assignment rule for dynamic groups." }
|
|
required: [host_group_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_host_groups
|
|
name: crowdstrike-delete-host-groups
|
|
description: "Delete one or more host groups by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "Comma-separated host group IDs to delete." }
|
|
required: [host_group_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_host_group_members
|
|
name: crowdstrike-list-host-group-members
|
|
description: "List devices that are members of a host group, with optional FQL filter and pagination."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "Host group ID to list members of." }
|
|
filter: { type: string, description: "Optional FQL filter to narrow results." }
|
|
limit: { type: string, description: "Max members to return (default 50)." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
sort: { type: string, description: "Sort expression, e.g. hostname.asc." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: add_host_group_members
|
|
name: crowdstrike-add-host-group-members
|
|
description: "Add one or more hosts to a host group by device ID."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "ID of the host group to add hosts to." }
|
|
host_ids: { type: string, description: "Comma-separated device IDs to add." }
|
|
required: [host_group_id, host_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: remove_host_group_members
|
|
name: crowdstrike-remove-host-group-members
|
|
description: "Remove one or more hosts from a host group by device ID."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "ID of the host group to remove hosts from." }
|
|
host_ids: { type: string, description: "Comma-separated device IDs to remove." }
|
|
required: [host_group_id, host_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Cases ─────────────────────────────────────────────────────────────────
|
|
- id: list_case_summaries
|
|
name: crowdstrike-list-case-summaries
|
|
description: "List case summaries. If ids are provided, fetches those specific cases; otherwise queries all cases sorted by creation date and returns their summaries."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated case IDs (optional). If omitted, all cases are listed." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_evidence_for_case
|
|
name: crowdstrike-get-evidence-for-case
|
|
description: "Retrieve full case details including evidence for a single case by ID. Evidence is available at resources[0].evidence in the response."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Case ID." }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: add_case_tag
|
|
name: crowdstrike-add-case-tag
|
|
description: "Add one or more tags to an existing case."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Case ID." }
|
|
tags: { type: string, description: "Comma-separated tags to add." }
|
|
required: [id, tags]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_case_tag
|
|
name: crowdstrike-delete-case-tag
|
|
description: "Remove a single tag from an existing case."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Case ID." }
|
|
tag: { type: string, description: "Tag to remove." }
|
|
required: [id, tag]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: resolve_case
|
|
name: crowdstrike-resolve-case
|
|
description: "Update a case: change status, name, description, assigned analyst, or severity."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Case ID." }
|
|
status: { type: string, description: "New case status (optional)." }
|
|
name: { type: string, description: "New case name (optional)." }
|
|
assigned_to_uuid: { type: string, description: "UUID of the analyst to assign the case to (optional)." }
|
|
description: { type: string, description: "Updated case description (optional)." }
|
|
severity: { type: number, description: "Severity level as an integer (optional)." }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_detection_summaries
|
|
name: crowdstrike-list-detection-summaries
|
|
description: "List alert/detection summaries. Accepts explicit composite IDs or an FQL filter to query alerts first, then fetches full entities."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
fetch_query: { type: string, description: "FQL filter to query alerts (optional, used when ids are not provided)." }
|
|
ids: { type: string, description: "Comma-separated alert composite IDs (optional). Takes priority over fetch_query." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: endpoint
|
|
name: crowdstrike-endpoint
|
|
description: "Look up a device/endpoint by device ID, local IP, or hostname; returns full device details for matches."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Device ID to match (optional)." }
|
|
ip: { type: string, description: "Local IP address to match (optional)." }
|
|
hostname: { type: string, description: "Hostname to match (optional)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
# RTR script/file management and extended Real Time Response commands
|
|
# Fragment — matches manifest.yaml command block format
|
|
|
|
- id: upload_script
|
|
name: crowdstrike-upload-script
|
|
description: "Upload a PowerShell script to the RTR cloud script library."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
name: { type: string, description: "Script name (unique identifier in the library)." }
|
|
permission_type: { type: string, description: "Visibility: private, group, or public (default private)." }
|
|
content: { type: string, description: "PowerShell script content." }
|
|
required: [name, content]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_script
|
|
name: crowdstrike-get-script
|
|
description: "Retrieve one or more RTR cloud scripts by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
script_id: { type: string, description: "Comma-separated script IDs." }
|
|
required: [script_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_script
|
|
name: crowdstrike-delete-script
|
|
description: "Delete an RTR cloud script by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
script_id: { type: string, description: "Script ID to delete." }
|
|
required: [script_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_scripts
|
|
name: crowdstrike-list-scripts
|
|
description: "List all RTR cloud scripts available in the tenant."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_files
|
|
name: crowdstrike-list-files
|
|
description: "List all RTR PUT files (files available for deployment to hosts)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_file
|
|
name: crowdstrike-get-file
|
|
description: "Retrieve one or more RTR PUT files by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
file_id: { type: string, description: "Comma-separated PUT file IDs." }
|
|
required: [file_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_file
|
|
name: crowdstrike-delete-file
|
|
description: "Delete an RTR PUT file by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
file_id: { type: string, description: "PUT file ID to delete." }
|
|
required: [file_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: refresh_session
|
|
name: crowdstrike-refresh-session
|
|
description: "Refresh an existing RTR session for a host, extending its TTL."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "Device ID of the host whose session to refresh." }
|
|
required: [host_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_host_files
|
|
name: crowdstrike-list-host-files
|
|
description: "List files extracted from an RTR session on a specific host. Opens a new session if no session_id is provided."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "Device ID of the target host." }
|
|
session_id: { type: string, description: "Existing RTR session ID (optional; a new session is opened if omitted)." }
|
|
required: [host_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_remove_file
|
|
name: crowdstrike-rtr-remove-file
|
|
description: "Open an RTR batch session and remove a file from one or more hosts using the rm command."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_ids: { type: string, description: "Comma-separated device IDs." }
|
|
file_path: { type: string, description: "Full path of the file to remove on the host." }
|
|
os: { type: string, description: "Target OS: Windows, Linux, or Mac." }
|
|
queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." }
|
|
timeout: { type: string, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_ids, file_path, os]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_list_network_stats
|
|
name: crowdstrike-rtr-list-network-stats
|
|
description: "Open an RTR batch session on a single host and run netstat to list active network connections."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "Device ID of the target host." }
|
|
queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." }
|
|
timeout: { type: string, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_list_scheduled_tasks
|
|
name: crowdstrike-rtr-list-scheduled-tasks
|
|
description: "Open an RTR batch session and enumerate scheduled tasks on Windows hosts via schtasks."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
host_ids: { type: string, description: "Comma-separated device IDs." }
|
|
queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." }
|
|
timeout: { type: string, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── ML Exclusions ──────────────────────────────────────────────────────────
|
|
- id: create_ml_exclusion
|
|
name: crowdstrike-create-ml-exclusion
|
|
description: "Create a new ML exclusion to prevent the machine learning engine from triggering on a specific value."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
value: { type: string, description: "The exclusion value (e.g. file path or hash)." }
|
|
excluded_from: { type: string, description: "Comma-separated list of ML detection categories to exclude from (e.g. blocking,extraction)." }
|
|
comment: { type: string, description: "Optional comment describing the reason for the exclusion." }
|
|
groups: { type: string, description: "Comma-separated host group IDs to scope the exclusion. Defaults to all groups." }
|
|
required: [value, excluded_from]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: update_ml_exclusion
|
|
name: crowdstrike-update-ml-exclusion
|
|
description: "Update an existing ML exclusion by ID (value, comment, or groups)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "ML exclusion ID to update." }
|
|
value: { type: string, description: "New exclusion value (optional)." }
|
|
comment: { type: string, description: "Updated comment (optional)." }
|
|
groups: { type: string, description: "Comma-separated host group IDs to replace the current scoping (optional)." }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_ml_exclusion
|
|
name: crowdstrike-delete-ml-exclusion
|
|
description: "Delete one or more ML exclusions by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated ML exclusion IDs to delete." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_ml_exclusion
|
|
name: crowdstrike-search-ml-exclusion
|
|
description: "Search ML exclusions by explicit IDs, a value substring match, or an FQL filter; returns full exclusion entities."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated exclusion IDs (takes priority over value and filter)." }
|
|
value: { type: string, description: "Value substring to search for (takes priority over filter when ids is absent)." }
|
|
filter: { type: string, description: "FQL filter string (used when neither ids nor value is provided)." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
sort: { type: string, description: "Sort expression, e.g. value.asc." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── IOA Exclusions ─────────────────────────────────────────────────────────
|
|
- id: create_ioa_exclusion
|
|
name: crowdstrike-create-ioa-exclusion
|
|
description: "Create a new IOA exclusion to suppress a specific Indicator of Attack pattern."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
exclusion_name: { type: string, description: "Display name for the IOA exclusion." }
|
|
pattern_id: { type: string, description: "ID of the IOA pattern to exclude." }
|
|
cl_regex: { type: string, description: "Command-line regular expression to match." }
|
|
ifn_regex: { type: string, description: "Image filename regular expression to match." }
|
|
pattern_name: { type: string, description: "Human-readable pattern name (optional)." }
|
|
comment: { type: string, description: "Optional comment." }
|
|
description: { type: string, description: "Optional description." }
|
|
groups: { type: string, description: "Comma-separated host group IDs to scope the exclusion. Defaults to all groups." }
|
|
detection_json: { type: string, description: "Optional detection JSON override." }
|
|
required: [exclusion_name, pattern_id, cl_regex, ifn_regex]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: update_ioa_exclusion
|
|
name: crowdstrike-update-ioa-exclusion
|
|
description: "Update an existing IOA exclusion by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "IOA exclusion ID to update." }
|
|
exclusion_name: { type: string, description: "New display name (optional)." }
|
|
pattern_id: { type: string, description: "New pattern ID (optional)." }
|
|
pattern_name: { type: string, description: "New pattern name (optional)." }
|
|
cl_regex: { type: string, description: "New command-line regex (optional)." }
|
|
ifn_regex: { type: string, description: "New image filename regex (optional)." }
|
|
comment: { type: string, description: "Updated comment (optional)." }
|
|
description: { type: string, description: "Updated description (optional)." }
|
|
groups: { type: string, description: "Comma-separated host group IDs to replace current scoping (optional)." }
|
|
detection_json: { type: string, description: "Updated detection JSON (optional)." }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_ioa_exclusion
|
|
name: crowdstrike-delete-ioa-exclusion
|
|
description: "Delete one or more IOA exclusions by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated IOA exclusion IDs to delete." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_ioa_exclusion
|
|
name: crowdstrike-search-ioa-exclusion
|
|
description: "Search IOA exclusions by explicit IDs, a name substring match, or an FQL filter; returns full exclusion entities."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated exclusion IDs (takes priority over name and filter)." }
|
|
name: { type: string, description: "Name substring to search for (takes priority over filter when ids is absent)." }
|
|
filter: { type: string, description: "FQL filter string (used when neither ids nor name is provided)." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Quarantine ─────────────────────────────────────────────────────────────
|
|
- id: list_quarantined_file
|
|
name: crowdstrike-list-quarantined-file
|
|
description: "List quarantined files by explicit IDs or an FQL filter query."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated quarantined file IDs (takes priority over filter)." }
|
|
filter: { type: string, description: "FQL filter string (used when ids is absent)." }
|
|
limit: { type: string, description: "Max results to return (default 50)." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: apply_quarantine_file_action
|
|
name: crowdstrike-apply-quarantine-file-action
|
|
description: "Apply an action (delete, release, or unrelease) to one or more quarantined files."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated quarantined file IDs." }
|
|
action: { type: string, description: "Action to apply: delete, release, or unrelease." }
|
|
comment: { type: string, description: "Comment explaining the reason for the action." }
|
|
required: [ids, action, comment]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Spotlight CVE ──────────────────────────────────────────────────────────
|
|
- id: cve
|
|
name: crowdstrike-cve
|
|
description: "Retrieve Falcon Spotlight vulnerability details for one or more CVE IDs, including CVE facet metadata."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
cve: { type: string, description: "Comma-separated CVE IDs to look up (e.g. CVE-2021-44228,CVE-2022-3786)." }
|
|
required: [cve]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: spotlight_list_host_by_vulnerability
|
|
name: crowdstrike-spotlight-list-host-by-vulnerability
|
|
description: "List hosts affected by one or more CVE IDs using Falcon Spotlight, with host_info facet details."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
cve_ids: { type: string, description: "Comma-separated CVE IDs to filter by (e.g. CVE-2021-44228)." }
|
|
limit: { type: string, description: "Max results to return (default 50)." }
|
|
required: [cve_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── ODS — On-Demand Scans ────────────────────────────────────────────────────
|
|
- id: ods_query_scan
|
|
name: crowdstrike-ods-query-scan
|
|
description: "Query ODS scans by ID or FQL filter. If ids provided, fetch those scans directly; otherwise query and resolve."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated scan IDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_query_scheduled_scan
|
|
name: crowdstrike-ods-query-scheduled-scan
|
|
description: "Query ODS scheduled scans by ID or FQL filter. If ids provided, fetch those scans directly; otherwise query and resolve."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated scheduled scan IDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_query_scan_host
|
|
name: crowdstrike-ods-query-scan-host
|
|
description: "Query ODS scan hosts by ID or FQL filter. If ids provided, fetch those scan-host records directly; otherwise query and resolve."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated scan-host IDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_query_malicious_files
|
|
name: crowdstrike-ods-query-malicious-files
|
|
description: "Query ODS malicious files by file_ids or FQL filter. If file_ids provided, fetch those records directly; otherwise query and resolve."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
file_ids: { type: string, description: "Comma-separated malicious file IDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_create_scan
|
|
name: crowdstrike-ods-create-scan
|
|
description: "Create an ODS on-demand scan targeting specific hosts and/or host groups."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
hosts: { type: string, description: "Comma-separated device IDs to scan." }
|
|
host_groups: { type: string, description: "Comma-separated host group IDs to scan." }
|
|
file_paths: { type: string, description: "Comma-separated file paths to include in the scan." }
|
|
scan_inclusions: { type: string, description: "Comma-separated scan inclusion patterns." }
|
|
description: { type: string, description: "Optional description for the scan." }
|
|
quarantine: { type: string, description: "Quarantine detected malicious files: true or false." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_create_scheduled_scan
|
|
name: crowdstrike-ods-create-scheduled-scan
|
|
description: "Create a recurring ODS scheduled scan for one or more host groups."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_groups: { type: string, description: "Comma-separated host group IDs (required)." }
|
|
file_paths: { type: string, description: "Comma-separated file paths to include." }
|
|
scan_inclusions: { type: string, description: "Comma-separated scan inclusion patterns." }
|
|
description: { type: string, description: "Optional description." }
|
|
schedule_start_timestamp: { type: string, description: "ISO 8601 start timestamp (required)." }
|
|
schedule_interval: { type: string, description: "Recurrence: Never, Daily, Weekly, Every other week, Every four weeks, or Monthly (required)." }
|
|
required: [host_groups, schedule_start_timestamp, schedule_interval]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_delete_scheduled_scan
|
|
name: crowdstrike-ods-delete-scheduled-scan
|
|
description: "Delete one or more ODS scheduled scans by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated scheduled scan IDs to delete." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── CSPM — Cloud Security Posture Management ──────────────────────────────────
|
|
- id: cspm_list_policy_details
|
|
name: crowdstrike-cspm-list-policy-details
|
|
description: "Retrieve CSPM policy details for one or more policy IDs."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
policy_ids: { type: string, description: "Comma-separated CSPM policy IDs." }
|
|
required: [policy_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: cspm_list_service_policy_settings
|
|
name: crowdstrike-cspm-list-service-policy-settings
|
|
description: "List CSPM service policy settings for a given policy ID and cloud platform."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
policy_id: { type: string, description: "CSPM policy ID." }
|
|
cloud_platform: { type: string, description: "Cloud platform: aws (default), azure, or gcp." }
|
|
service: { type: string, description: "Optional cloud service name to filter." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
required: [policy_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: cspm_update_policy_settings
|
|
name: crowdstrike-cspm-update-policy-settings
|
|
description: "Update CSPM policy settings: enable/disable, change severity, scope to regions or account."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
policy_id: { type: string, description: "CSPM policy ID to update (required)." }
|
|
account_id: { type: string, description: "Optional cloud account ID to scope the update." }
|
|
enabled: { type: string, description: "Enable policy: true (default) or false." }
|
|
regions: { type: string, description: "Comma-separated regions to scope the policy." }
|
|
severity: { type: string, description: "Optional severity override." }
|
|
tag_excluded: { type: string, description: "Exclude tagged resources: true or false." }
|
|
required: [policy_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Users / Rules / Alerts ────────────────────────────────────────────────────
|
|
- id: list_users
|
|
name: crowdstrike-list-users
|
|
description: "List Falcon users. If id provided, fetch those users directly; otherwise query with optional filter."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Comma-separated user UUIDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
offset: { type: string, description: "Pagination offset (default 0)." }
|
|
limit: { type: string, description: "Max results to return (default 50)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_ioarules
|
|
name: crowdstrike-get-ioarules
|
|
description: "Retrieve IOA (Indicator of Attack) custom rules by rule ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
rule_ids: { type: string, description: "Comma-separated IOA rule IDs." }
|
|
required: [rule_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_cnapp_alerts
|
|
name: crowdstrike-list-cnapp-alerts
|
|
description: "List CNAPP container security alerts, optionally filtered by FQL expression."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "Optional FQL filter to narrow results." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: resolve_identity_detection
|
|
name: crowdstrike-resolve-identity-detection
|
|
description: "Resolve or update Falcon Identity Detection alerts: change status, assign, comment, tag, or unassign."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated composite alert IDs (required)." }
|
|
update_status: { type: string, description: "New status, e.g. new, in_progress, closed, or reopened." }
|
|
assign_to_uuid: { type: string, description: "Analyst UUID to assign the detection to." }
|
|
append_comment: { type: string, description: "Comment text to append." }
|
|
add_tag: { type: string, description: "Tag to add to the detection." }
|
|
remove_tag: { type: string, description: "Tag to remove from the detection." }
|
|
unassign: { type: string, description: "Unassign the detection: true or false." }
|
|
show_in_ui: { type: string, description: "Show in UI: true or false." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: resolve_mobile_detection
|
|
name: crowdstrike-resolve-mobile-detection
|
|
description: "Resolve or update Falcon Mobile Detection alerts: change status, assign, comment, tag, or unassign."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated composite alert IDs (required)." }
|
|
update_status: { type: string, description: "New status, e.g. new, in_progress, closed, or reopened." }
|
|
assign_to_uuid: { type: string, description: "Analyst UUID to assign the detection to." }
|
|
append_comment: { type: string, description: "Comment text to append." }
|
|
add_tag: { type: string, description: "Tag to add to the detection." }
|
|
remove_tag: { type: string, description: "Tag to remove from the detection." }
|
|
unassign: { type: string, description: "Unassign the detection: true or false." }
|
|
show_in_ui: { type: string, description: "Show in UI: true or false." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_workflow_definitions
|
|
name: crowdstrike-list-workflow-definitions
|
|
description: "List Falcon Fusion workflow definitions using an optional FQL filter, pagination offset/limit, and sort expression."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "FQL filter expression." }
|
|
limit: { type: string, description: "Maximum number of results (default 50)." }
|
|
offset: { type: string, description: "Pagination offset (default 0)." }
|
|
sort: { type: string, description: "Sort expression, e.g. name.asc." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: workflow_execute
|
|
name: crowdstrike-workflow-execute
|
|
description: "Trigger execution of one or more Falcon Fusion workflow definitions."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
definition_id: { type: string, description: "Comma-separated workflow definition IDs to execute." }
|
|
name: { type: string, description: "Optional workflow name filter." }
|
|
key: { type: string, description: "Optional idempotency key for the execution." }
|
|
source_event_url: { type: string, description: "Optional source event URL." }
|
|
execution_cid: { type: string, description: "Comma-separated CIDs to target for execution." }
|
|
body: { type: string, description: "JSON string body to pass as the execution payload (default {})." }
|
|
required: [definition_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_workflow_executions
|
|
name: crowdstrike-list-workflow-executions
|
|
description: "List Falcon Fusion workflow execution records using an optional FQL filter, pagination offset/limit, and sort expression."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "FQL filter expression." }
|
|
limit: { type: string, description: "Maximum number of results (default 50)." }
|
|
offset: { type: string, description: "Pagination offset (default 0)." }
|
|
sort: { type: string, description: "Sort expression, e.g. start_timestamp.desc." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_workflow_execution_results
|
|
name: crowdstrike-list-workflow-execution-results
|
|
description: "Retrieve detailed results for one or more workflow execution IDs."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated workflow execution IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: workflow_execution_action
|
|
name: crowdstrike-workflow-execution-action
|
|
description: "Perform an action (cancel or resume) on one or more workflow executions."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated workflow execution IDs." }
|
|
action_name: { type: string, description: "Action to perform: cancel or resume.", enum: [cancel, resume] }
|
|
required: [ids, action_name]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_identity_entities
|
|
name: crowdstrike-list-identity-entities
|
|
description: "Query Falcon Identity Protection entities (users or endpoints) via the GraphQL API, returning risk scores and factors."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Entity type: USER or ENDPOINT.", enum: [USER, ENDPOINT] }
|
|
limit: { type: string, description: "Maximum number of nodes to return (default 50)." }
|
|
primary_display_name: { type: string, description: "Optional filter by primary display name (informational; include in query if supported)." }
|
|
email: { type: string, description: "Optional filter by email address (informational; include in query if supported)." }
|
|
required: [type]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Connectivity test ─────────────────────────────────────────────────────
|
|
- id: test_connection
|
|
name: crowdstrike-test-connection
|
|
description: "Verify connectivity and credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|